From
Fortune
Diebold struggles to bounce back from the controversy surrounding its voting machines
Oct. 30, 2006
By Barney Gimbel, Fortune writer-reporter
(Fortune Magazine) -- Here's a five-step plan guaranteed to make an obscure company absolutely notorious.
First get into a business you don't understand, selling to customers who barely understand it either. Then roll out your product without adequate testing. Don't hire enough skilled people. When people notice problems, deny, obfuscate and ignore. Finally, blame your critics when it all blows up in your face.
With missteps like those, it would be hard to succeed in the gumball business. But when your product is the hardware and software of democracy itself, that kind of performance gets you called not just incompetent but evil - an enemy of democracy. And that is what has happened to Diebold Inc. (Charts) of Canton, Ohio, since it got into the elections business in 2001.
The move seemed like a good idea at the time. The $3 billion public company, whose core products are ATMs, bank vaults and security systems, had just sold 186,000 voting machines to Brazil, where they delivered a quick and clean count in the 2000 presidential elections.
Surely, Diebold reasoned, it could duplicate this success closer to home. ...
But faster than you can say hanging chad, things went wrong. In early 2003, activists found a version of Diebold's secret software on the Internet. The code had so many security flaws that one group would later post a video of a chimpanzee changing votes.
Weeks later, Diebold's then-CEO Walden O'Dell famously wrote to fellow Bush supporters in a fundraising letter that he was committed to "help Ohio deliver its electoral votes to the President." ...
Though other voting-machine companies have also had their difficulties ... "The reason Diebold gets so much heat," says activist Bev Harris, author of "Black Box Voting: Ballot Tampering in the 21st Century," "is not because they're any worse than their competitors. It's because we got more information on them early on."
The drumbeat of bad news has never stopped. This year, researchers have found more security flaws, and another version of the software was leaked. ...
...
But after a close look at Diebold and its operations, it's hard to see the company as evil. ... "We didn't know a whole lot about the elections business when we went into it, "admits Swidarski. "Here we are, a bunch of banking folks thinking making voting machines would be similar to making ATMs. We've learned some pretty painful lessons."
A history of success
A cow, a lantern, and a straw-filled barn made Charles Diebold (pronounced DEE-bold) a household name in the banking world. It was the night of Oct. 8, 1871, when, ... the Great Chicago Fire started ... When 878 Diebold safes survived with their contents unharmed, business took off.
...
... Then, in the 1960s, the company bet its future on a speculative technology: automated teller machines.
Diebold quickly became a global market leader. ...
In the mid-1990s, however, when rival NCR (Charts) passed it to become the market leader, Diebold changed tactics ... The company began buying up suppliers around the world, including a Brazilian ATM maker, Procomp Amazonia, in October 1999.
Entering the political sphere
Around the same time, the Brazilian government was looking to fully automate its election system. Procomp got the $106 million contract - Diebold's largest ever - to make 186,000 identical electronic voting machines for the 2000 presidential election.
...
Emboldened by Diebold's success in Brazil, CEO Walden O'Dell set out to ensure that the company got a serious piece of the U.S. elections business.
...
In June 2001, Diebold announced it was acquiring Global Electronic Systems, based in McKinney, Texas, for about $30 million. Global was a $7 million operation that made most of its money printing ballots for its optical-scan reading machine. Its touch-screen system, the Accu-Vote-TS, wasn't a big seller.
Nothing was a big seller then. ... That's because their customers were poor.
U.S. elections are intensely local affairs, run by more than 3,000 separate counties. Buying new equipment was a luxury. ...
That all changed when Congress passed the Help America Vote Act in 2002. ...
Local election officials soon found themselves inundated by high-powered lobbyists. "I don't think those election boards had ever seen as many dinners out," says Paul Tipps, a prominent Democrat who lobbied for Diebold in Ohio.
With its main rivals - Oakland, Calif.-based Sequoia Voting Systems and Omaha, Neb.-based Election Systems & Software - making inroads in Florida, Diebold targeted other states. In March 2002, just two months after it completed its purchase of Global, Maryland put in a $13 million order to equip four counties with touch-screen machines. In May, Georgia signed a $54 million contract to buy 20,000 Diebold machines.
Early warning signs
After the takeover, the big contracts meant big problems. Diebold had let the Global operation alone, but it just couldn't keep up. ...
Recalls Swidarski, the unit lacked "the wherewithal really to know how to manage a business. ..."
The same could be said of the customers. Election administrators were often unsophisticated county employees who had been in the job forever. "If we work with Bank of America and they want to roll out 1,000 ATMs, they'll have 25 professional project managers," says Swidarski. "You go to a meeting at a county and you're looking at two people."
It didn't help that Global's touch-screen system, the AccuVote-TS, was flawed from the start. It had purchased the technology from a small company called I-Mark, whose founders had designed it as an unattended voting terminal that could be used in places like shopping malls or supermarkets. "The only problem was they weren't looking at security," says Douglas Jones, a computer science professor at University of Iowa who has been testing voting machines since 1994.
Not quite the only problem. Because there was little demand for touch-screen systems before 2001, Global hadn't spent much on software development. (Jones thinks they needed to start over.)
So the system voters used in 2002 was bug-ridden. ... Even so, after the election, press accounts largely glossed over the problems as isolated hiccups. Orders continued to roll in. And then things fell apart.
...
One key moment came when Bev Harris heard her suburban Seattle county was considering switching to electronic touch-screen machines. Curious, she started trawling the Internet for information - and late one night in January 2003, she discovered a cache of files on an unprotected Diebold server. In it were e-mails between programmers discussing the system's problems.
"Distributing this software is extremely dangerous," a programmer wrote in 2001. "Our smart-card format has absolutely no security, ..." (Diebold says the problem was fixed before the 2002 elections.)
Digging further, Harris found a version of the company's secret software that ran the machines. She passed it to Avi Rubin ... at Johns Hopkins University in Baltimore. Within an hour, Rubin says, he discovered that the software's encryption system was one "everyone knew was broken since 1998." That same day, he found that the administrative password to all the machines was the same: 1-1-1-1.
"It looked like an experimental student project," Rubin says. "If it was my student's project, they would have gotten an F." His report, which came out two days after Maryland had awarded Diebold a $56 million contract for 11,000 touch-screen machines, galvanized those who had always been suspicious of electronic voting.
The company pointed out in a 27-page retort that the software wasn't in use and that there were checks and balances to prevent fraud. The response didn't satisfy the skeptics; ...
In 2004, California decertified Diebold machines and joined a civil lawsuit ...
At the same time, it continued to have manufacturing problems, ...
Changing gears
Soon, Swidarski, then a senior marketing executive in the ATM unit, took over the elections business. ...
Swidarski fired many Global staff and brought in a new boss from Canton, ... The voting unit began to operate more smoothly, grossing $150 million in 2005 and making a small profit.
In December 2005, the board pushed O'Dell out and named Swidarski CEO. ...
Swidarski is cut from a different cloth than his predecessor. O'Dell liked deals ... ; he loved being known as one of Bush's Pioneers ... O'Dell's top priority was to make the numbers.
Swidarski, by contrast, is more focused on the customers than he is on Wall Street. ...
...
Dubious voting
But its voting machines continue to attract scorn. In August, Edward Felten ... at Princeton University, got his hands on a Diebold machine ... With the help of two graduate students, he posted a video online that showed him infiltrating and installing a virus in what appears to be less than a minute.
Felten found that the key to the lock protecting the memory card ... was one commonly used in office furniture and even hotel minibars. Once the door to the slot was open, he could slip in a virus-infested memory card and alter votes. ...
Diebold disputes the accuracy, integrity and plausibility of the Princeton study, pointing out that Felten's team used an old machine ...
"The report all but ignores physical security and election procedures," says Mark Radke, marketing director of Diebold Election Systems. ...
Therein lies the rub, says Michael Shamos, a computer-science professor at Carnegie Mellon University who has been testing election equipment since 1980.
"Diebold doesn't fully get it about security," he says. ...
Even so, Shamos doesn't completely buy the Princeton study. "What Felten found wasn't a bug in the software," he says. "It was a deliberate feature that comes from the need to be able to update the machines quickly."
...
A national rollout of almost any product is bound to have glitches. But when elections depend upon the product in a country whose politics are scarred by distrust, there is little tolerance for error.
...
As for Diebold, Swidarski is questioning whether the election business "fits into our product portfolio." He says he'll make a decision within the next three months. But it says something that Swidarski recently ordered the name "Diebold" removed from the front of the voting equipment. ...
Reporter associate Susan Kaufman contributed to this article.